Splunk Search

How to add a static value to a table with one column?

brajaram
Communicator

I'm trying to add a single value to a table I use to dynamically populate a selector in a dashboard. The search I use to populate the dropdown is:

index=initial search|dedup pageURL| table pageURL

I want to add to the end of the search something that can be a * value. The reason for this is that in my dashboards built off of the input, I use $pageURL$ to allow viewers to select the specific page they wish to see stats for. However, I want a specific value where I set pageURL=*so that viewers can see what all the pages look like. I tried doing the following as the search to populate the dropdown:

index=initial search|dedup pageURL| table pageURL | append [|table pageURL | eval pageURL="*"]

But that didn't add a value of * to the end of the table. Is there a way I can do this?

Tags (2)
0 Karma
1 Solution

livehybrid
Influencer

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

View solution in original post

maciep
Champion

Also, if I understand what you're asking correctly, I typically add a manual entry to the input as well. You can call that one "All" and give it a value of *. So then your users would have an All option in the dropdown along with each pageURL from your dynamic search.

That's might be a bit easier than trying to append it to your dynamic search.

brajaram
Communicator

I didn't even think about adding a static value, thanks! That does seem a lot more efficient.

0 Karma

livehybrid
Influencer

Yes that is true - You'd be as well to add the static entry. but...now you know about makeresults!

livehybrid
Influencer

Give this a go:

index=initial search|dedup pageURL| table pageURL | append [| makeresults 1 | eval pageURL="*" | table pageURL]

I hope this helps!

Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...